Notes from the assessors who
mark Cyber Essentials
Guides to the 2026 Danzell question set, what we see on CE Plus audit days, scheme news as IASME and the NCSC publish it, and the end-of-support dates that decide whether you pass.
Browse by category
What an assessor actually reads in your notes field
54 of the 106 questions in the Danzell question set are answered in a free-text notes field. Here is what an IASME assessor looks for in those boxes, the wording that passes, and the wording that comes back as a query.
Read the postThe answers that fail Cyber Essentials automatically in 2026
Four questions in the 2026 Danzell question set fail automatically on a No answer, and A7.15 fails automatically if a listed service does offer MFA. Here they are, what each one requires, and how to fix the answer before you submit.
Read the postCyber Essentials for a five-person company: a worked example
A worked example: a five-person consultancy with laptops, phones, Microsoft 365 and no server goes from first read to certificate. Scope, fee band, the questions that take time, and what the assessor queried.
Read the postThe 14-day rule in practice: Patch Tuesday, Apple, Chrome and your firewall
Cyber Essentials gives you 14 days from release to install critical and high-risk security updates. Here is how that window plays out against real vendor release cycles, and how to set each one up so you never count days.
Read the postPasskeys, FIDO2 and Cyber Essentials: what counts as MFA now
Requirements v3.3 updated the passwordless definition to name FIDO2 and treats FIDO2 authenticators as MFA. What that means for A7.16, A7.17 and the firewall password question, and what still does not count.
Read the postCyber Essentials Plus day: what the assessor does hour by hour
A Cyber Essentials Plus audit runs the five test cases in the NCSC test specification v3.2 against a sample of your devices and every cloud service. Here is the order we run them in, what we need from you at each step, and what ends the day early.
Read the postScheme changes, once a month
Question-set updates, end-of-support dates and what our assessors are failing this month. No sales sequence. What each issue covers.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh